pyproject.toml

[project]
name = "nemoplatform"
description = "NeMo Platform"
readme = "README.md"
requires-python = ">=3.11,<3.15"
license = "Apache-2.0"
license-files = ["LICENSE", "NOTICE"]

classifiers = [
  "Development Status :: 4 - Beta",

  "Intended Audience :: Developers",
  "Intended Audience :: Science/Research",
  "Topic :: Scientific/Engineering :: Artificial Intelligence",
  "Topic :: Scientific/Engineering :: Human Machine Interfaces",
  "Topic :: Software Development",

  "License :: OSI Approved :: Apache Software License",

  "Programming Language :: Python :: 3.11",
  "Programming Language :: Python :: 3.12",
  "Programming Language :: Python :: 3.13",
  "Programming Language :: Python :: 3.14",
]

# Root workspace dependencies - minimal set for workspace tooling only.
# Service packages are NOT listed here - they're defined in dependency-groups
# for container builds. This allows --only-group to work correctly.
dependencies = [
  "base58>=2.1.1",
  "fastapi[standard]==0.138.0",
  "uvicorn[standard]>=0.12.0",
  "sacrebleu",
  "jinja2==3.1.6",
  "h11>=0.16.0",
  "protobuf<7.0.dev0,>=6.33.5", # fix for GHSA OOS
  "pyyaml>=6.0.2",
  "pydantic>=2.10.6",
  "mypy-extensions==1.0.0",
  "tornado>=6.5.7",             # pinned for CVE GHSA-7cx3-6m66-7c5m (>=6.5.0) + GHSA-qjxf-f2mg-c6mc (<=6.5.4, fixed in 6.5.5)
  "tomlkit>=0.13.3",
  "nmp-guardrails",
  "nmp-hello-world",
  "nmp-intake",
  "nmp-core-mcp",
  "nemo-platform",
  "nemo-platform-ext",
  "nmp-common",
  "garak-api",
  "nmp-platform",
  "nmp-platform-seed",
  "nmp-secrets",
  # Core services needed for OpenAPI generation (platform imports these dynamically)
  "nmp-auth",
  "nmp-models",
  "models",
  "nmp-files",
  "nmp-inference-gateway",
  "nmp-jobs",
  "nmp-entities",
  "orjson>=3.11.6",
  "hvac>=2.3.0",
  "nmp-studio",
  "nmp-platform-runner",
  "requests>=2.33.1",
]
version = "0.0.0"

[dependency-groups]
# Optional Insights analyst plugin.
insights = ["nemo-insights-plugin"]
dev = [
  "pre-commit>=3.8.0",
  "pydantic-settings>=2.6.1",
  "pytest-asyncio>=0.24.0",
  "pytest-cov>=6.0.0",
  "pytest-env>=1.1.0",
  "pytest-subtests>=0.13.1",
  "pytest-rerunfailures>=14.0",
  "pytest-timeout>=2.3.1",
  "pytest>=9.0.3",
  "fastapi[standard]==0.138.0",
  "papermill>=2.6.0",
  "aiohttp>=3.14.1",
  "ipykernel>=6.29.5",
  "ty==0.0.56",
  "hatchling>=1.26.3",
  "nmp-testing",
  "mlflow-skinny>=3.11.1,<3.12.0", # Optional dep for fine-tuning (shipped in training images); skinny variant to test API surface without bloating uv.lock
  "nemo-platform-plugin",          # Optional runtime dep; included here for type checking
  "nvidia-nat-atif>=1.8.0,<1.9",   # ATIF schema models for agentic-use trajectory validation
  "nemo-platform-sdk-tools",       # Include SDK/license tool migration target for testing
  "nmp-build-tools",               # Build hook helpers imported by package-local hatch_build.py files
  "nmp-dev-mcp",                   # Include MCP dev tools
  # These are the dev dependencies from `sdk/python/nemo-platform`.
  # Including here until we find a better way to include them.
  "pyright==1.1.399",
  "mypy",
  "respx",
  "pytest",
  "pytest-asyncio",
  "ruff==0.15.7",
  "time-machine",
  "nox",
  "dirty-equals>=0.6.0",
  "importlib-metadata>=6.7.0",
  "rich>=13.7.1",
  "ruamel.yaml>=0.18.0",
  "typer>=0.9.0",
  "nest_asyncio==1.6.0",
  "pytest-xdist>=3.6.1",
  "pytest-mock>=3.14.1",
  "pytest-httpserver>=1.0.0",
  "aioresponses>=0.7.8",
  "httpx-aiohttp>=0.1.8",
  "aiosqlite>=0.20.0",
  "greenlet>=3.0.0",
  # nemo-nb/docs dependencies
  "nemo_nb",
  "myst-parser>=4.0.0",
  "sphinx-design>=0.6.0",
  "python-dotenv>=1.2.2",
  # Service packages for local development (not in root deps to allow --only-group in containers)
  "nemo-anonymizer-plugin",
  "nemo-data-designer-plugin",
  "nmp-guardrails",
  "nemo-safe-synthesizer-plugin",
  "nmp-hello-world",
  "nmp-intake",
  "nmp-core-mcp",
  "nemo-platform",
  "nemo-platform-ext",
  "nmp-common",
  "nmp-platform",
  "nmp-secrets",
  "blockbuster>=1.5.26",
]

# =============================================================================
# Container Build Dependency Groups
# =============================================================================
# These groups define which packages to install for each container type.
# Each group is self-contained and does NOT inherit from the root project deps.
#
# Usage in Dockerfile (use --only-group to exclude root project deps):
#   uv sync --frozen --only-group core-services --no-editable
#   uv sync --frozen --only-group functional-services --no-editable
#   uv sync --frozen --only-group cpu-tasks --no-editable
#   uv sync --frozen --only-group gpu-tasks --no-editable
# =============================================================================

# Base dependencies for all Python containers.
# Keep both CLIs available in every image: `nemo` for service startup and
# `nemo-platform` for task-oriented backward compatibility.
# nemo-platform-plugin provides the runtime interfaces used by first-party plugins bundled into images.
# Each container group explicitly lists only the services it needs.
nmp-base = [
  "nmp-common",
  "nemo-platform",
  "nmp-platform",
  "nemo-platform-plugin",
]

# Extra runtime needed specifically for `nemo services run` in service images.
nmp-services-runtime = ["nemo-platform[services]"]

# First-party plugins installed by default for local syncs and core service images.
enabled-plugins = [
  "nemo-anonymizer-plugin",
  "nemo-data-designer-plugin",
  "nemo-evaluator-plugin",
  "nemo-guardrails-plugin",
  "nemo-auditor-plugin",
  "nemo-safe-synthesizer-plugin",
  "nemo-switchyard",
  "nemo-agents-plugin",
  "nemo-deployments-plugin[docker,k8s]",
  "nemo-customizer-plugin",
  "nemo-automodel-plugin",
  "nemo-unsloth-plugin",
  "nemo-rl-plugin",
]

# Legacy runtime needed specifically for task images that still invoke
# `nemo-platform run task` for backwards compatibility.
nmp-task-runtime = ["nmp-platform"]

# Core infrastructure services (for the core-services container set)
# These are the minimal services needed for core platform functionality
core-services = [
  { include-group = "nmp-base" },
  { include-group = "nmp-services-runtime" },
  "nmp-auth",
  "nmp-models",
  "nmp-files",
  "nmp-inference-gateway",
  "nmp-jobs",
  "nmp-secrets",
  "nmp-entities",
  { include-group = "enabled-plugins" },
]

# All functional services (for nmp-api container)
# Includes core services plus all application services
functional-services = [
  { include-group = "core-services" },
  "nmp-studio",
  "nmp-guardrails",
  "nemo-data-designer-plugin",
  "nemo-anonymizer-plugin",
  "nmp-intake",
  "nmp-hello-world",
  "nmp-platform-seed",
]

# CPU task dependencies (for nmp-cpu-tasks container)
# Services that have CPU-only batch tasks
cpu-tasks = [
  { include-group = "nmp-base" },
  { include-group = "nmp-task-runtime" },
  "nemo-anonymizer-plugin",
  "nemo-data-designer-plugin",
  "nmp-hello-world",
]

# GPU task dependencies (for nmp-gpu-tasks container)
# Services that have GPU-intensive batch tasks
gpu-tasks = [
  { include-group = "nmp-base" },
  { include-group = "nmp-task-runtime" },
  "nmp-models",
]


[project.scripts]
generate-config-docs = "script.generate_config_docs:main"

[tool.uv]
prerelease = "if-necessary-or-explicit"
index-strategy = "unsafe-best-match"
required-version = ">=0.9.14,<0.10.0"
cache-keys = [{ file = "pyproject.toml" }]
# Keep uv's implicit dev default and also install enabled plugins on bare `uv sync`.
default-groups = ["dev", "enabled-plugins"]
# this section is used to constrain the uv lockfile generation to specific environments
# which is very useful for debugging resolution issues and constraining the overall
# complexity of the locking step
# https://docs.astral.sh/uv/reference/settings/#environments
environments = [
  "platform_machine == 'arm64' and sys_platform == 'darwin'",
  "sys_platform == 'linux' and platform_machine == 'x86_64'",
  # we have to add the following to make the right python packages for linux
  # for downstream use in our linux/arm64 docker images.
  # there's subtle differences in the naming convention on the python side
  # even though they are the same architecture, so we use aarch64
  "sys_platform == 'linux' and platform_machine == 'aarch64'",
]

constraint-dependencies = [
  "GitPython>=3.1.49",
  "Mako>=1.3.12",
  "Pygments>=2.20.0",
  "aiohttp>=3.14.1",                      # High/Medium/Low OOS – auditor-tasks + customizer
  "authlib>=1.6.11",
  "black>=26.3.1",
  "bleach>=6.4.0",
  "cryptography>=48.0.1,<49",
  "diffusers>=0.38.0",
  "filelock>=3.20.3",
  "jupyter-server>=2.20.0",
  "jupyterlab>=4.6.1",
  "joserfc>=1.7.2",
  "langchain-community>=0.3.31,<0.4",     # 0.4.x removes the vertexai import path used by ragas 0.4.3
  "langchain-core>=1.4.9",
  "langchain-nvidia-ai-endpoints>=1.4.3",
  "langchain-openai>=1.3.5",
  "langgraph>=1.2.6",
  "langsmith>=0.9.7",
  "json-repair>=0.60.1",
  "litellm>=1.83.10",
  "lxml>=6.1.0",
  "mistune>=3.3.2",
  "msgpack>=1.2.1",
  "nbconvert>=7.17.1",
  "nltk>=3.10.0",
  "pillow>=12.3.0",
  "postcss>=8.5.10",
  "pyasn1>=0.6.3",
  "python-multipart>=0.0.27",
  "regex>=2025.10.22",
  "safetensors>=0.8.0rc0",                # explicit prerelease so uv allows the rc
  "sqlfluff>=4.2.2",
  "starlette>=1.3.1",
  "urllib3>=2.7.0",
  "uv>=0.9.14,<0.10.0",
]

override-dependencies = [
  # unsloth requires a later version but will never be used on macos. mostly useful for dev
  "datasets>=3.3.1, <=4.3.0",
  "jsonpath-ng>=1.6.1",
  "grpcio>=1.71.0",
  "huggingface-hub>=1.0.1,<2.0.0",
  "pydantic[email]>=2.9.2",             # openai-harmony depends on a later pydantic, but that causes the stainless gen to hit an infinite loop
  "ray; sys_platform == 'never'",       # ray has an unfixed critical CVE, as for why we're removing it this way see https://github.com/astral-sh/uv/issues/9174
  "fschat; sys_platform == 'never'",    # fschat is unmaintained with unfixed High/Medium CVEs; transitive via garak but never imported
  "diskcache; sys_platform == 'never'", # unfixed CVE-2025-69872; transitive via ragas but not imported
  "botocore>=1.40.46,<1.40.62",         # ngcsdk requires botocore>=1.37; upper bound required by aiobotocore 2.25.1 (aioboto3 15.5.0)
  # todo(dn-v2): unpin these. this was originally causing tests to fail.
  "aiodns==3.5.0",
  "pycares==4.11.0",
  "authlib>=1.6.9",          # Critical – nmp-api/core/cpu-tasks/gpu-tasks
  "aiohttp>=3.14.1",         # High/Medium/Low OOS – auditor-tasks + customizer
  "jaraco-context>=6.1.0",   # High OOS – auditor-tasks + customizer
  "joserfc>=1.7.2",
  "pyasn1>=0.6.3",           # High OOS – auditor-tasks + customizer
  "setuptools>=78.1.1",      # High OOS – nmp-cpu-tasks/gpu-tasks/customizer-tasks
  "urllib3>=2.7.0",          # High OOS – auditor-tasks + customizer
  "wheel>=0.46.2",           # High OOS – widespread
  "cbor2>=5.9.0",            # High – customizer + nmp-gpu-tasks
  "simpleeval>=1.0.5",       # High – nmp-api + nmp-gpu-tasks
  "ujson>=5.12.0",           # High – nmp-api/cpu-tasks/gpu-tasks
  "xgrammar>=0.1.32",        # High – customizer + nmp-gpu-tasks
  "fastmcp>=3.2.0",          # GHSA-vv7q-7jx5-f767 (Critical) + GHSA-rww4-4w9c-7733 (High); overrides vendored sdk/python/nemo-platform <3 constraint
  "wandb>=0.28.0",           # wandb-core Go CVEs (nspect); unsloth + training images
  "cryptography>=48.0.1,<49", # Pulse Critical; overrides data-designer-engine 0.7.0's <47 cap after changelog review
  "click>=8.2.0",            # Below CVEs are based on constraints that garak has
  "litellm>=1.83.10",        # CVE-2026-42208 (Critical SQL injection), CVE-2026-40217, and 5 other High CVEs
  "python-dotenv>=1.2.2",
  "openai>=2.26.0",

]

[tool.uv.sources]
nmp-auth = { workspace = true }
nemo-anonymizer-plugin = { workspace = true }
nemo-data-designer-plugin = { workspace = true }
data-designer-nemo = { workspace = true }
nemo-evaluator-sdk = { workspace = true }
nmp-guardrails = { workspace = true }
nmp-intake = { workspace = true }
nmp-jobs = { workspace = true }
nmp-models = { workspace = true }
nmp-inference-gateway = { workspace = true }
nmp-files = { workspace = true }
nmp-entities = { workspace = true }
models = { workspace = true }
nemo-platform-sdk = { workspace = true }
nemo-platform = { workspace = true }
nemo-platform-ext = { workspace = true }
nemo-platform-sdk-tools = { workspace = true }
nmp-core-mcp = { workspace = true }
nemo-nb = { workspace = true }
nmp-common = { workspace = true }
garak-api = { workspace = true }
nmp-platform = { workspace = true }
nmp-platform-runner = { workspace = true }
nmp-platform-seed = { workspace = true }
nmp-hello-world = { workspace = true }
nmp-studio = { workspace = true }
nmp-secrets = { workspace = true }
nmp-dev-mcp = { workspace = true }
nmp-testing = { workspace = true }
nmp-build-tools = { workspace = true }
nemo-platform-plugin = { workspace = true }
nemo-insights-plugin = { workspace = true }

nemo-evaluator-plugin = { workspace = true }
nemo-guardrails-plugin = { workspace = true }
nemo-auditor-plugin = { workspace = true }
nemo-safe-synthesizer-plugin = { workspace = true }
nemo-switchyard = { workspace = true }
nemo-agents-plugin = { workspace = true }
nemo-deployments-plugin = { workspace = true }
nemo-agents-example-calculator = { workspace = true }
nemo-agents-example-email-phishing = { workspace = true }
nemo-customizer-plugin = { workspace = true }
nemo-automodel-plugin = { workspace = true }
nemo-unsloth-plugin = { workspace = true }
nemo-rl-plugin = { workspace = true }
nmp-automodel = { workspace = true }
nmp-unsloth = { workspace = true }
nmp-rl = { workspace = true }
nmp-customization-common = { workspace = true }


[tool.uv.workspace]
members = [
  "packages/nemo_platform_plugin",
  "packages/nmp_build_tools",
  "packages/nemo_platform",
  "packages/filesets",
  "packages/nmp_common",
  "packages/nmp_customization_common",
  "packages/nmp_platform_runner",
  "packages/garak_api/",
  "packages/nmp_testing",
  "packages/nemo_nb",
  "packages/data_designer_nemo",
  "packages/nmp_platform",
  "services/hello-world",
  "services/studio",
  "services/guardrails",
  "services/intake",
  "plugins/nemo-anonymizer",
  "plugins/nemo-data-designer",
  "services/core/auth",
  "services/platform-seed",
  "services/core/jobs",
  "services/core/entities",
  "services/core/models",
  "services/core/inference-gateway",
  "services/core/files",
  "services/core/secrets",
  "services/core/mcp",
  "tools/nemo-platform-sdk-tools",
  "tools/mcp-dev-tools",
  "packages/nmp_testing",
  # SDK
  "sdk/python/nemo-platform",
  "packages/nemo_platform_ext",
  "packages/nemo_evaluator_sdk",
  "packages/filesets",
  "packages/models",
  "plugins/nemo-guardrails",
  "plugins/nemo-evaluator",
  "plugins/nemo-auditor",
  "plugins/nemo-safe-synthesizer",
  "plugins/nemo-switchyard",
  "plugins/nemo-agents",
  "plugins/nemo-deployments",
  "plugins/nemo-insights",
  "plugins/nemo-agents/examples/calculator-agent",
  "plugins/nemo-agents/examples/email-phishing-analyzer",
  "plugins/nemo-customizer",
  "plugins/nemo-automodel",
  "plugins/nemo-unsloth",
  "plugins/nemo-rl",
  "services/automodel",
  "services/unsloth",
  "services/rl",
]


[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
packages = ["packages/nmp_platform/", "script/"]

# Pytest configuration is now in pytest.ini
# This section is kept for reference but pytest.ini takes precedence
# [tool.pytest.ini_options]
# testpaths = [
#     "tests/integration",
#     "packages/nmp_common/tests",
# ]


[tool.coverage.run]
# Measure branch coverage in addition to statement coverage
branch = true
parallel = true
source = ["packages/", "services/"]
omit = [
  "*/tests/*",
  "*/test_*.py",
  "*/*_test.py",
  "*/__pycache__/*",
  "*/conftest.py",
  "*/.venv/*",
  "*/venv/*",
  "*/.tox/*",
  "*/setup.py",
  "*/site-packages/*",
]

[tool.coverage.report]
# Fail if coverage falls below this percentage
fail_under = 0 # Start at 0, increase as tests are added
precision = 2
show_missing = true
skip_covered = false
skip_empty = true
sort = "Cover"
exclude_lines = [
  # Standard exclusions
  "pragma: no cover",
  "def __repr__",
  "def __str__",
  "raise AssertionError",
  "raise NotImplementedError",
  "if __name__ == .__main__.:",
  "if TYPE_CHECKING:",
  # Abstract methods
  "@(abc\\.)?abstractmethod",
  # Defensive programming
  "except ImportError:",
  "except ModuleNotFoundError:",
  # Logging
  "logger\\.",
]
exclude_also = [
  # Exclude files that are auto-generated
  '\A(?s:.*# NOTE: This file is auto-generated.*)\Z',
]

[tool.coverage.html]
directory = "htmlcov"

[tool.coverage.xml]
output = "coverage.xml"

[tool.pyright]
extraPaths = [
  "plugins/nemo-guardrails/src",
  "plugins/nemo-evaluator/src",
  "plugins/nemo-insights/src",
  "tests/agentic-use",
  "tests/agentic-use/shared",
]
executionEnvironments = [
  { root = "tests/agentic-use", extraPaths = [
    "tests/agentic-use",
    "tests/agentic-use/shared",
  ] },
]

[tool.ty.environment]
python-version = "3.11"
extra-paths = [
  # nemo-data-designer plugin is a workspace member; add its src so ty can
  # resolve nemo_data_designer_plugin imports from plugin test files.
  "plugins/nemo-data-designer/src",
  # data-designer-nemo library is a workspace member; add its src so ty can
  # resolve data_designer_nemo imports from library and plugin test files.
  "packages/data_designer_nemo/src",
  # nemo-agents plugin is not a workspace member; add its src so ty can
  # resolve nemo_agents_plugin imports when checking plugin test files.
  "plugins/nemo-agents/src",
  # example-plugin is not a workspace member; add its src so ty can
  # resolve nmp.example_plugin imports when checking plugin test files.
  "plugins/example-plugin/src",
  # nemo-guardrails plugin is not a workspace member; add its src so ty can
  # resolve nemo_guardrails_plugin imports when checking plugin test files.
  "plugins/nemo-guardrails/src",
  # So ``integration.*`` and ``from .utils import`` resolve in plugin tests (PEP 420).
  "plugins/nemo-guardrails/tests",
  # nemo-evaluator plugin is not a workspace member; add its src so ty can
  # resolve nemo_evaluator imports when checking plugin test files.
  "plugins/nemo-evaluator/src",
  # The optional Insights analyst is not part of the default environment.
  "plugins/nemo-insights/src",
  # Agentic-use tests place both tests/agentic-use and tests/agentic-use/shared
  # on sys.path in tests/conftest.py.
  "tests/agentic-use",
  "tests/agentic-use/shared",
]

[tool.ty.src]
# Below is a list of excluded directories from ty typechecks.
# Each directory corresponds to a CODEOWNER group who has a shared responsibility
# for the ensuring type safety of the code in that directory.
# No directories should be added to the exclusion group, unless is results in more
# code being typechecked (for example, excluding a set of subdirectories once one of
# their parent has been removed to the exclusion group).
exclude = [
  ".uv_cache", # Cache Dir in CI

  "./script/",

  "packages/nmp_common/",
  "packages/nemo_platform_ext/",
  "packages/nemo_nb/",

  "packages/nemo_platform_plugin/src/nemo_platform_plugin/jobs/api_factory.py",

  "packages/garak_api/",

  # GPU-container training drivers import torch/peft/nemo_automodel/unsloth/nemo_rl at runtime only.
  "services/automodel/src/nmp/automodel/tasks/training/backends/",
  "services/automodel/src/nmp/automodel/tasks/training/utils.py",
  "services/unsloth/src/nmp/unsloth/tasks/training/backends/",
  "services/rl/src/nmp/rl/tasks/training/backends/",
  "services/rl/src/nmp/rl/tasks/training/utils.py",
  "services/rl/src/nmp/rl/tasks/training/runner.py",
  # Helm chart test payloads run inside purpose-built Kubernetes containers.
  # The NCCL worker imports torch at runtime, which is not part of the root
  # workspace type-checking environment.
  "k8s/helm/files/nccl-test/",

  "./services/guardrails/",

  "./services/intake/",

  "./services/core/",

  "./services/jailbreak-detect/",

  "./tests/",

  # Installed in the normal workspace graph now, but still has standalone `ty`
  # diagnostics against strict Switchyard and test typings. Keep excluded from
  # root `ty` until that cleanup lands in a focused follow-up.
  "plugins/nemo-switchyard/",

  "docs/",

  "./sdk/",

  "tools/nemo-platform-sdk-tools/src/nemo_platform_sdk_tools/sdk",
  "tools/nemo-platform-sdk-tools/tests/sdk",
]